A recent vulnerability, identified as CVE-2022-44566, has been discovered in ActiveRecord's PostgreSQL adapter versions earlier than 7..4.1 and 6.1.7.1. This vulnerability allows a potential attacker to exploit the target system by launching a Denial of Service (DoS) attack. In this blog post, we will break down the technical details of this vulnerability and demonstrate how it can be exploited.

Vulnerability Details

The vulnerability emerges when a value outside the range of a 64-bit signed integer is provided to the PostgreSQL connection adapter. The adapter then treats the target column type as numeric. Comparing integer values against numeric values can prompt a slow sequential scan, potentially causing a Denial of Service.

To understand this better, let's examine the vulnerable code snippet

# lib/active_record/connection_adapters/postgresql_adapter.rb

def type_cast_for_database(value)
  case value
  when Range
    "int8range(#{value.begin},#{value.end},#{value.exclude_end? ? ']' : '['})"
  else
    super(value)
  end
end

In this code snippet, the type_cast_for_database method handles the input parameter value. If the provided value is a range, an int8range function is supposed to convert the value into a format suitable for the database.

However, if the range input comprises values beyond the range of a 64-bit signed integer, PostgreSQL treats the target column type as numeric. Subsequently, any comparisons between integer and numeric values induce a slow sequential scan in the database query, which could lead to a Denial of Service.

To exploit this vulnerability, an attacker just needs to provide a value within the aforementioned range.

# Example of exploit payload
range = 9223372036854775808..922337203685477581

Depending on the Rails application's implementation, this payload can be inserted into the attack vector through URL parameters or form inputs.

Mitigation

The ActiveRecord and Ruby on Rails teams have promptly addressed the issue by releasing updates to ActiveRecord's PostgreSQL adapter: version 7..4.1 and version 6.1.7.1. Upgrading to these versions resolves the vulnerability.

For more details about the vulnerability and patch, refer to the following resources

1. Ruby on Rails Security Advisory: https://github.com/rails/rails/security/advisories/GHSA-9xfg-x68m-533c
2. National Vulnerability Database (NVD) Entry: https://nvd.nist.gov/vuln/detail/CVE-2022-44566
3. Rubygems.org ActiveRecord Gem: https://rubygems.org/gems/activerecord

Conclusion

CVE-2022-44566 showcases that even widely used and well-maintained libraries such as ActiveRecord can contain vulnerabilities. It is crucial for developers to keep their libraries up-to-date with the latest security fixes. In this specific case, upgrading to the patched ActiveRecord's PostgreSQL adapter version significantly reduces the risk of falling victim to a Denial of Service attack.

Timeline

Published on: 02/09/2023 20:15:00 UTC
Last modified on: 02/16/2023 20:22:00 UTC